ENISA Threat Landscape 2026: Phishing and vulnerability exploitation dominate attacks

An analysis of 8,257 incidents shows how phishing, vulnerability exploitation, and AI are reshaping the cyberthreat landscape.

Key takeaways

• Phishing accounted for 78% of incidents involving social engineering.
• DDoS attacks appeared in 51% of incidents analyzed, while 40% resulted in unauthorized access.
• Among unauthorized access incidents, 60% involved vulnerability exploitation.
• Shared tools and attack paths are making attribution harder—but also helping defenders focus their efforts.
• AI is accelerating how attackers develop, target, and execute cyberattacks.

What does the ENISA Threat Landscape 2026 reveal?

An analysis of 8,257 incidents that occurred in 2025 within the European Union makes it clear phishing remains the top vector that leads to some type of unauthorized attack.

Published last month by the European Union Agency for Cybersecurity (ENISA), the report finds that more than half the incidents (51%) analyzed involved some type of low-impact distributed denial of service (DDoS) attack, while another 40% led to an actual unauthorized access. Among those unauthorized access incidents, 60% involved exploitation of vulnerabilities in internet-facing infrastructure, edge devices, cloud and identity systems, legacy Internet of Things (IoT) platforms, developer tools, or third-party platforms. Another 21% were attributed to misconfiguration, and accidental exposure remain a concern (20.7%)

Of all attacks that used some type of social engineering lure, the most widely used threat vector was phishing (78%), followed by malicious spam at a distant 13%, according to the report. Overall, well over half of all incidents (57%) involved some type of ideology-driven attack, compared to 29% that were attributed to attacks motivated by financial gain.

Finally, the report noted that cybercriminals as early as last year were using consumer-grade artificial intelligence (AI) to help craft attacks, an issue that will only become more problematic as cybercriminals adopt more advanced AI tools.

Why is vulnerability management becoming more difficult?

The pace at which vulnerabilities are now being discovered in the AI era has already dramatically increased. According to the NIST National Vulnerability Database, more than 84,000 new Common Vulnerabilities and Exposures (CVEs) have been received this year, which is on top of the more than 48,000 CVEs the report says were published in 2025.

While understanding the methods used to launch attacks is always relevant to defenders, the report notes that cybercriminals, hacktivists, and state-linked groups increasingly use similar tools, vulnerabilities, services, and access methods. While that convergence makes attribution harder, it also suggests that cybersecurity teams can focus their attention on attack paths that are now being more commonly shared. The challenge, of course, is that more cyberattacks are becoming polymorphic in the sense that continuous changes to code and signatures are made every time malware replicates or executes.

How should cybersecurity teams prepare for AI-driven attacks?

More challenging still, many of these attacks now starting to be made at machine speed, thanks to the help of AI. Additionally, it now only requires a few hours to use almost any AI model available to create a much more targeted exploit by reverse engineering a vulnerability. Most of the existing defenses and processes that cybersecurity teams have in place today are, as a result, in danger of becoming overwhelmed.

For now at least, it appears that adversaries are content to apply AI to augment and extend their existing tactics and techniques. However, it’s also only a matter of time before they leverage AI models and coding tools to develop more novel attacks that are likely to prove more lethal. The challenge now is to proactively get ahead of what will soon become much more precise attacks versus waiting for a series of major incidents to occur before marshalling the AI resources needed to ultimately fight fire with fire.